How to Block and Audit Web Activity with Microsoft Defender for Business

This guide will show you how to use Microsoft Defender to block websites and monitor web activity in your business environment. Learn how to prevent staff from accessing unauthorized websites and track web usage across your organization.

Prerequisites

• One of the following licenses:
  • Microsoft 365 Business Premium
  • Microsoft Defender for Business (standalone)
  • Microsoft 365 E3 + Microsoft Defender for Endpoint P1
  • Microsoft 365 E5
• Access to security.microsoft.com or security.microsoft.com/endpoints
• Global Administrator or Security Administrator role

Important Notes

• All devices must be Azure AD joined or Hybrid Azure AD joined
• Microsoft Intune enrollment is required for all devices
• Microsoft Defender Antivirus must be enabled and running
• There may be up to 2 hours delay in reporting data
• Web protection policies have a maximum limit of URLs that can be blocked

Step 1: Access Microsoft Defender Security Center

1. Navigate to security.microsoft.com
2. Sign in with your admin credentials

Step 2: Device Registration

For your first device:

1. Navigate to the Devices tab
2. Click "Add a device"
3. Select your operating system
4. Follow the on-screen instructions

Note: Additional devices will require Azure Intune setup.

Step 3: Configure Web Filtering

1. Go to Settings Endpoint Web filtering
2. Enable web filtering and Custom network indicators

Creating a Web Filtering Policy

1. Navigate to Settings Endpoint Web filtering
2. Click "Add service/policy"
3. Name your policy (e.g., "Block Streaming Services")
4. Select categories to block (e.g., streaming media under high bandwidth)
5. Define the scope (which devices the policy affects)

Step 4: Block Specific Websites

1. Go to Settings Endpoint Indicators URLs/Domains
2. Click "Add an item"
3. Enter the URL or domain to block (e.g., www.netflix.com)
4. Choose an action:
   • Block: Prevent access completely
   • Audit: Monitor access without user notification
5. Configure additional settings as needed
6. Set the scope for affected devices

Step 5: Monitoring Web Activity

1. Access the Devices tab
2. Select the device you want to investigate
3. Review detailed information including:
   • Website access duration
   • Device details (IP address, model, manufacturer)
   • Usage patterns

Advanced Monitoring Options

• Access detailed reports under Reports Web Protection
• Use Advanced Hunting queries for detailed investigation
• Export reports for compliance and auditing purposes
• Set up custom alerts for specific websites or usage patterns

Additional Resources

For more detailed information, consult these Microsoft documentation resources:

• Network Protection Guide
• Web Content Filtering Setup Guide

Share Your Experience

If you've encountered this issue and followed the steps outlined in this article, we'd love to hear from you. Please leave a comment below to share whether this solution helped resolve the problem. Additionally, if you found a different method that worked, we encourage you to share that as well. Your feedback is invaluable in helping us and others who may face similar issues.

Need Further Assistance?

If you're still facing issues or would like personalized guidance, we're here to help. Check out our dedicated support plans at IT Solver Support Plans for expert assistance tailored to your needs.